Skip to content
adversarial

Update some of an incident's editable fields, by ID

PATCH
/v1/incidents/{id}
curl --request PATCH \
  --url https://api.adversarial.com/api/v1/incidents/INC-00001 \
  --header 'Content-Type: application/json' \
  --data '{ "assigned_to": null, "contained_date": null, "description": null, "detected_date": null, "occurred_date": null, "parent_id": null, "responded_date": null, "severity": null, "severity_reasoning": null, "source": null, "status": null, "tags": null, "threat_objectives": null, "title": null }'

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
id
required
string

The ID of the incident to update — INC-00001 (case-insensitive) or a bare number

Example
INC-00001

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json

The incident fields to change. Omitted fields are left as they are.

object
assigned_to
string | null format: uuid
contained_date
string | null format: date-time
description
string | null
detected_date
string | null format: date-time
occurred_date
string | null format: date-time
parent_id

Mark this incident as linked under another incident. Some(Some(id)) sets the parent; Some(None) clears it; None leaves it untouched.

string | null
Example
INC-00001
responded_date
string | null format: date-time
severity
One of:
null
severity_reasoning
string | null
source
string | null
status
One of:
null
tags
Array<string> | null
threat_objectives
Array<object> | null

A threat objective paired with how relevant it is to a risk.

Two relations are considered the same when the objective and its relevance match; created_date records when the relation was last changed and is not part of its identity.

object
created_date

The time that this relation was mutated

string | null format: date-time
relevance
One of:
null
threat_objective
required

The threat objective type

string
Allowed values: Sabotage Data Disclosure Extortion Customer Targeting Resource Hijacking Fraud
title
string | null

Responses

Section titled “Responses”

200

Section titled “200”

Incident updated

Media typeapplication/json

Register row for an Incident. An Incident plus the relational data shown on the incident register: risk associations, threat objectives, tags, and comment count.

object
comment_count
required
integer format: int64
incident
required

Relationship, core incident information

object
assigned_to
One of:
null
contained_date
string | null format: date-time
created_date
required
string format: date-time
description
required
string
detected_date
required
string format: date-time
id
required
string
occurred_date
string | null format: date-time
opened_by
required

A User as returned by the API.

Profile images are not embedded — clients fetch them from GET /api/v1/{icon} when icon is Some.

object
email
required
string
first_name
required
string
icon

Relative path to the user’s avatar endpoint, e.g. "users/{id}/avatar?v={hash}". None when the user has no avatar.

string | null
id
required
string format: uuid
last_name
required
string
parent_id

When set, this incident is linked under the named parent incident.

string | null
responded_date
string | null format: date-time
severity
One of:
null
severity_reasoning
string | null
source
required

Where the incident was reported from (e.g. “Employee Reported”). Always present.

string
status
required

The status of an incident

string
Allowed values: New In Progress Review Closed
title
required
string
updated_by
required

A User as returned by the API.

Profile images are not embedded — clients fetch them from GET /api/v1/{icon} when icon is Some.

object
email
required
string
first_name
required
string
icon

Relative path to the user’s avatar endpoint, e.g. "users/{id}/avatar?v={hash}". None when the user has no avatar.

string | null
id
required
string format: uuid
last_name
required
string
updated_date
required
string format: date-time
linked_children_count
required

Number of incidents linked under this incident (i.e. children pointing at it). An incident is itself a linked child when incident.parent_id is set.

integer format: int64
risk_associations
required
Array<string>
tags
required
Array<object>
object
content
required
string
creator_id
required
string format: uuid
id
required
string format: uuid
org_id
string | null format: uuid
threat_objectives
required
Array<object>

A threat objective paired with how relevant it is to a risk.

Two relations are considered the same when the objective and its relevance match; created_date records when the relation was last changed and is not part of its identity.

object
created_date

The time that this relation was mutated

string | null format: date-time
relevance
One of:
null
threat_objective
required

The threat objective type

string
Allowed values: Sabotage Data Disclosure Extortion Customer Targeting Resource Hijacking Fraud
Example
{
  "incident": {
    "id": "INC-00001",
    "parent_id": "INC-00001",
    "severity": "SEV-5",
    "status": "New"
  },
  "threat_objectives": [
    {
      "relevance": "Moderate",
      "threat_objective": "Sabotage"
    }
  ]
}

400

Section titled “400”

Validation failed (e.g. empty payload, unknown source, inactive assignee)

404

Section titled “404”

Incident not found

422

Section titled “422”

Invalid parent link (self-link, cycle, multi-layer nesting, or deleted parent)